Method for Updating Selinux Security Policy and Terminal

ABSTRACT

A method for updating a SELinux security policy and a terminal. The method includes receiving, by the terminal, a security policy file sent by a server. The method further includes, performing, by the terminal in a power-on status, storing the security policy file in preset storage space by using a first service or process, modifying, by the terminal, a value of a preset attribute value from a first value to a second value by using the first service or process, reading, when it is detected that the value of the preset attribute value is changed from the first value to the second value, the security policy file from the preset storage space by using a second service or process and writing the security policy file into a memory, and loading, by the terminal, the security policy file in the memory by using the second service or process.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a National Stage of International Application No.PCT/CN2017/108436, filed Oct. 30, 2017, which is hereby incorporated byreference in its entirety.

TECHNICAL FIELD

This application relates to the field of operating system technologies,and in particular, to a method for updating a Security-Enhanced Linux®(SELinux) security policy and a terminal.

BACKGROUND

With popularization of intelligent terminals such as a smartphone,security of the intelligent terminals is increasingly important.Application of a SELinux technology in an existing operating systemplatform greatly improves security of the operating system. For example,the SELinux technology is applied to an Android™ system. In the SELinuxtechnology, a security policy file is formulated, and access permissionsfor access of different processes to system resources are specified inthe security policy file, so that the different processes have differentaccess permissions. This ensures that in the process, not only a basicfunction of the process can be performed but also malicious use of thesystem resources can be prevented. Based on a premise that each processfunction is ensured, an access permission of the process is minimized,to ensure maximum system security. A permission of a process beyond aregular service brings a safety risk to the entire system. To modify theaccess permission of the process, only the security policy file can bemodified and updated to a terminal. An existing update manner is asfollows: The security policy file is modified, a system upgrade patchpackage is recompiled and generated, and the generated system upgradepatch package is pushed to the intelligent terminal in an over-the-air(OTA) programming manner. Then, the intelligent terminal upgrades thesystem by using the system upgrade patch package, to update the securityfile. When the security policy file is updated by upgrading the system,the intelligent terminal needs to be restarted. This may interrupt thecurrent service. When the system upgrade patch package is relativelylarge, a repair time is relatively long.

SUMMARY OF THE INVENTION

This application discloses a method for updating a SELinux securitypolicy and a terminal, so as to resolve a prior-art problem that acurrent service is interrupted because a terminal is restarted when asecurity policy file is updated in a system upgrade manner and that arepair time is relatively long when a system upgrade patch package isrelatively large.

According to a first aspect, a method for updating a SELinux securitypolicy applied to a terminal is provided. The method includes:receiving, by the terminal, a security policy file sent by a server, andafter the receiving the security policy file, performing, by theterminal in a power-on status, the following steps: storing the securitypolicy file in preset storage space, reading the security policy filefrom the preset storage space and writing the security policy file intoa memory, and loading the security policy file in the memory.

The foregoing method provided in this embodiment of this application canupdate the security policy file formulated by using a SELinuxtechnology. In the update manner provided in this embodiment of thisapplication, the terminal does not need to be restarted, and a servicecurrently running on the terminal is not interrupted. In addition, afterreceiving the security policy file sent by the server, the terminal mayautomatically run the update method provided in this embodiment of thisapplication in the background. In addition, because only the securitypolicy file is updated and a process of refreshing a partition isomitted, an update speed of the security update process is large.Therefore, the updated security policy file can come into effectimmediately and quickly.

In a possible design, before the reading, by the terminal, the securitypolicy file from the preset storage space and writing the securitypolicy file into the memory, the method further includes: performing, bythe terminal, security and/or integrity check on the security policyfile stored in the preset storage space.

In a possible design, the storing, by the terminal, the security policyfile in preset storage space includes: storing, by the terminal, thesecurity policy file in the preset storage space by using a firstservice or process, where the reading, by the terminal, the securitypolicy file from the preset storage space and writing the securitypolicy file into a memory includes: modifying, by the terminal, a valueof a preset attribute value from a first value to a second value byusing the first service or process, and when it is detected that thevalue of the preset attribute value is changed from the first value tothe second value, reading, by the terminal, the security policy filefrom the preset storage space by using a second service or process andwriting the security policy file into the memory, where the loading, bythe terminal, the security policy file in the memory includes: loading,by the terminal, the security policy file in the memory by using thesecond service or process.

In a possible design of the first aspect, when the terminal is poweredoff, the value of the preset attribute value is changed from the secondvalue to the first value, and when the terminal is restarted, the methodfurther includes: in a kernel startup stage, modifying, by the terminal,the value of the preset attribute value from the first value to thesecond value, to read the security policy file from the preset storagespace and write the security policy file into the memory after it isdetected, in the second service or process, that the value of the presetattribute value is modified from the first value to the second value.

In a possible design of the first aspect, the first service or processis an update_sepolicy service, the second service or process is an initprocess, and the preset attribute value is an attribute value of aSELinux.reload_policy.

In a possible design in the first aspect, the storing, by the terminal,the security policy file in preset storage space, reading the securitypolicy file from the preset storage space and writing the securitypolicy file into a memory, and loading the security policy file in thememory includes: storing, by the terminal, the security policy file inthe preset storage space by using a preset service or process, readingthe security policy file from the preset storage space and writing thesecurity policy file into a memory, and loading the security policy filein the memory.

In a possible design of the first aspect, the preset service or processis an init process.

In a possible design of the first aspect, the preset storage space is apreset writable partition of the terminal.

According to a second aspect, a terminal is provided. The terminalincludes: a receiving unit, configured to receive a security policy filesent by a server, a processing unit, configured to write the securitypolicy file into a first storage unit while the terminal is in apower-on status, wherein the processing unit is further configured toread the security policy file from the first storage unit and write thesecurity policy file into a second storage unit, where the secondstorage unit is a memory, and the processing unit is further configuredto load the security policy file in the second storage unit.

In a possible design of the second aspect, the processing unit isfurther configured to perform security and/or integrity check on thesecurity policy file stored in the first storage unit.

In a possible design of the second aspect, the processing unit isfurther configured to: store the security policy file in the firststorage unit by using a first service or process, modify a value of apreset attribute value from a first value to a second value by using thefirst service or process, and when it is detected that the value of thepreset attribute value is changed from the first value to the secondvalue, read the security policy file from the first storage unit byusing a second service or process and write the security policy fileinto the second storage unit, and load the security policy file in thesecond storage unit by using the second service or process.

In a possible design of the second aspect, when the terminal is poweredoff, the value of the preset attribute value is changed from the secondvalue to the first value, and when the terminal is restarted, theprocessing unit is further configured to: in a kernel startup stage,modify the value of the preset attribute value from the first value tothe second value, to read the security policy file from the firststorage unit and write the security policy file into the second storageunit after it is detected, in the second service or process, that thevalue of the preset attribute value is modified from the first value tothe second value.

In a possible design of the first aspect, the first service or processis an update_sepolicy service, the second service or process is an initprocess, and the preset attribute value is an attribute value of aSELinux.reload_policy.

In a possible design of the second aspect, the processing unit isfurther configured to: store the security policy file in the firststorage unit by using a preset service or process, read the securitypolicy file from the first storage unit and write the security policyfile into the second storage unit, and load the security policy file inthe second storage unit.

In a possible design of the second aspect, the preset service or processis an init process.

In a possible design of the second aspect, the first storage unit is apreset writable partition of the terminal.

According to a third aspect, a terminal is provided. The terminalincludes: a communications interface, a processor, a memory, and a bus,where the memory includes a first memory and a second memory, and thesecond memory is a memory, the memory stores program code, and when theprogram code is executed by the processor, the terminal is enabled toperform the following steps: the communications interface is configuredto receive a security policy file sent by a server, and the processor isconfigured to write the security policy file into the first memory whilethe terminal is in a power-on status, read the security policy file fromthe first memory and write the security policy file into the secondmemory, and load the security policy file in the second memory.

In a possible design of the third aspect, the processor is furtherconfigured to perform security and/or integrity check on the securitypolicy file stored in the first memory.

In a possible design of the third aspect, the processor is furtherconfigured to: store the security policy file in the first memory byusing a first service or process, modify a value of a preset attributevalue from a first value to a second value by using the first service orprocess, and when it is detected that the value of the preset attributevalue is changed from the first value to the second value, read thesecurity policy file from the first memory by using a second service orprocess and write the security policy file into the second memory, andload the security policy file in the second memory by using the secondservice or process.

In a possible design of the third aspect, when the terminal is poweredoff, the value of the preset attribute value is changed from the secondvalue to the first value, and when the terminal is restarted, theprocessor is further configured to: in a kernel startup stage, modifythe value of the preset attribute value from the first value to thesecond value, to read the security policy file from the first memory andwrite the security policy file into the second memory after it isdetected, in the second service or process, that the value of the presetattribute value is modified from the first value to the second value.

In a possible design of the third aspect, the first service or processis an update_sepolicy service, the second service or process is an initprocess, and the preset attribute value is an attribute value of aSELinux.reload_policy.

In a possible design of the third aspect, the processor is furtherconfigured to: store the security policy file in the first memory byusing a preset service or process, read the security policy file fromthe first memory and write the security policy file into the secondmemory, and load the security policy file in the second memory.

In a possible design of the third aspect, the preset service or processis an init process.

In a possible design of the third aspect, the first memory is a presetwritable partition of the terminal.

According to a fourth aspect, a computer readable storage medium isprovided. The computer readable storage medium stores an instruction,and when the instruction is run on a terminal, the terminal is enabledto perform the method for updating a SELinux security policy accordingto the first aspect.

According to a fifth aspect, a computer program product including aninstruction is provided. When the computer program product is run on aterminal, the terminal is enabled to perform the method for updating aSELinux security policy according to the first aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is a schematic flowchart of a method for updating a SELinuxsecurity policy in the prior art;

FIG. 1B is a schematic interface diagram of applying the method shown inFIG. 1A to a terminal;

FIG. 2 is a schematic structural diagram of a mobile phone;

FIG. 3 is a schematic flowchart of a method for updating a SELinuxsecurity policy according to an embodiment of this application;

FIG. 4A is a schematic flowchart of still another method for updating aSELinux security policy according to an embodiment of this application;

FIG. 4B is a schematic flowchart of yet another method for updating aSELinux security policy according to an embodiment of this application;

FIG. 5 is a schematic interface diagram of applying the method in FIG.3, FIG. 4A, or

FIG. 4B to a terminal; and

FIG. 6 is a schematic structural diagram of a terminal according to anembodiment of this application.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

In a SELinux technology, a plurality of permission policies areformulated, so that an access subject has only a minimum accesspermission to an access object, thereby improving system security. Theaccess subject mainly refers to various processes, threads, and the likein the terminal. The access object mainly refers to various systemresources in the terminal that are used for communication, informationsharing, and storage, such as a file, a socket (socket), storage space,a directory, and a shared memory. A mobile phone is used as an example,system resources in the mobile phone include a system file stored in themobile phone, storage space of the mobile phone, storage directories ofdifferent storage space, and the like.

The permission policy defined in the SELinux can be expressed in thefollowing format: rule_name source_type target_type: object_classperm_set.

The rule_name is used to represent a type of the permission policy, andthe type may be “allow” or “forbid”. The source_type represents anaccess subject, and is usually a name of a process or a thread, thetarget_type: object_class represents an access object, and the perm_setrepresents an operation that can be performed by the access subject onthe access object (when the rule_name is the “allow”) or an operationthat is forbidden to be performed by the access subject on the accessobject (when the rule_name is the “forbid”). The object_class may befile, and represent a common file, or may be dir, and represent adirectory, or may be fd, and represent a file descriptor. When theobject_class is the file, the perm_set may represent a plurality ofoperations such as “read”, “write”, and “create”.

For example, a permission policy is: allow netd proc:file write. Theallow represents that the rule is an “allow rule”, the netd representsthat the access subject is an netd process, the proc:file representsthat the access object is a common file in a proc directory, and thewrite represents that an executable operation performed on the proc:fileand defined by the rule is “write”. Therefore, this permission policymeans allowing the netd process to access the common file in a procresource and to perform a write operation on the common file.

The SELinux has three optional modes in specific application: (1) Adisabled (disabled) mode: A disabled mode represents that the SELinux iscompletely invalid. (2) A permissive mode: A permissive mode representsthat only a log is recorded and an access behavior is not forbidden whena policy is violated. (3) An enforcing (enforcing) mode: An enforcingmode represents that a log is recorded and an access behavior isforbidden when a policy is violated. Currently, the SELinux may comeinto effect completely in an Android L version and later versions, andthe enforcing mode is enabled by default. In this mode, when anapplication program violates the permission policy, the resource cannotbe obtained, thereby causing some functions to be abnormal or invalid.When the SELinux technology is applied to an Android platform, theSELinux technology may also be referred to as SEAndroid.

When an access permission of the application program is excessivelylarge or excessively small, the foregoing permission policy formulatedby the SELinux needs to be modified. For example, an access permissionset for an application process A is allowing the application process Ato access or modify a system resource 1, but an actual service of theapplication process A does not need to access the system resource 1. Inthis case, if the application process A has vulnerability, the foregoingpermission granted to the application process A may cause systemresource 1 to be tampered with. As a result, there may be securityvulnerability in the terminal. In the foregoing application scenario,the terminal needs to modify the permission policy formulated by theSELinux, for example, modify an access permission of the applicationprocess A to the system resource 1. Currently, when a terminal such as amobile phone is delivered from a factory, a security policy file andanother file are used to generate an image file, and the image file iswritten into a specific read-only partition. When the security policyfile needs to be modified, a system is usually upgraded (in other words,a partition used to store the security policy file is updated) in an OTAupgrade manner to update the security policy file. The OTA upgraderefers to a technology in which a terminal downloads an upgrade packageon a remote server by using a wireless network to upgrade a system or anapplication, and is a common software upgrade manner of a currentAndroid system.

Referring to FIG. 1A, a storage area of a mobile phone 10 includes twoparts: a double data rate synchronous dynamic random access memory(Double Data Rate, DDR) 101 and an embedded multimedia card(EMMC)/universal flash memory (UFS) 102. The DDR 101 is equivalent to a“memory” of the mobile phone, and the EMMC/UFS 102 is equivalent to a“hard disk” of the mobile phone. For example, FIG. 1A shows a divisionof the EMMC/UFS 102, including a first bootloader partition, a secondbootloader partition, a misc partition, a boot partition, a recoverypartition, a cache partition, a modem partition, a system partition, adata partition, an sdcard partition, and the like.

The first bootloader partition, the second bootloader partition, and theboot partition store an application program related to startup of themobile phone, and are used for the startup of the mobile phone.Specifically, the first bootloader partition mainly performs hardwaredetection, and after determining that the hardware can work normally,copies a file in the second bootloader partition to the DDR to perform astartup operation. In the second bootloader partition, hardware isinitialized, a memory size is obtained, and the like. Then, codeincluded in the boot partition continues to be executed. The cachepartition is usually used to store a temporary cache generated by amobile phone system. The misc partition is used to store a temporaryfile in a flag type. Usually, a piece of system software with arestoration function is written into the recovery partition. The systemsoftware can rewrite or clear the existing system. The modem partitionis used to store files related to a baseband, for example, a filerelated to long term evolution (LTE) communication performed by themobile phone. The system partition is used to store a system file. Thepartition is read-only by default. In other words, the system filestored in the system partition cannot be modified. Generally, the datapartition is used to store user data, for example, data of variousAndroid packages (APK). The sdcard partition is used to mount a securedigital memory card (SD). When the mobile phone is powered on, datastored in the EMMC/UFS 102 is loaded to the DDR 101.

It should be noted that the foregoing partition division is merelydivision used as an example. In actual application, there may be anotherpartition form, and more or fewer partitions may be included.

In addition, in FIG. 1A, an example in which storage space of the mobilephone includes the DDR and the EMMC/UFS is used for description. Inanother implementation, the storage space of the mobile phone mayfurther include: a static random access memory (SRAM) storage area, aNand/Nor Flash storage area, a synchronous dynamic random access memory(SDRAM) storage area, and peripheral address space. The SRAM storagearea is equivalent to a “memory” of the mobile phone, the Nand/Nor Flashstorage area is a “hard disk” of the mobile phone, the Nand/Nor Flashstores all system data of the mobile phone, and the Nand/Nor Flash maybe divided into the foregoing partitions.

For example, a partition storing the security policy file is a bootpartition. Referring to FIG. 1A, a current OTA upgrade manner isspecifically as follows: A server 20 recompiles and produces an upgradepackage. The upgrade package is, for example, an OTA differentialpackage, and then the server 20 sends the upgrade package to the mobilephone 10. After receiving the upgrade package, the mobile phone 10 firstdownloads the upgrade package to a local computer (which may beunderstood as writing the upgrade package into storage space of themobile phone, for example, writing the upgrade package into a writablepartition, which is usually a DATA partition for Android), and thenrefreshes the upgrade packet from the writable partition into the bootpartition after a user agrees to upgrade, and a process of refreshingthe boot partition is performed based on a premise that the mobile phone10 needs to be restarted and system software stored in the recoverypartition is started to enter a recovery mode (also called an upgrademode). An operating mode of the mobile phone 10 includes a normal modeand a recovery mode. The recovery mode is a mode different from a normalpower-on mode of the mobile phone 10. The mobile phone 10 needs to berestarted to enter the recovery mode. After the boot partition isrefreshed, content in the boot partition is loaded to the memory onlywhen the mobile phone 10 is powered on. Therefore, the mobile phoneneeds to be restarted again to reload the content in the refreshed bootpartition, so that an updated security policy file comes into effect.

Referring to FIG. 1B, from a perspective visible to a user, an upgradeprocess after the mobile phone 10 receives the updated upgrade packageincludes: The mobile phone displays a screen (1), and the screen (1)displays a prompt message prompting the user to upgrade. When the mobilephone detects an operation no performed by the user to confirm theupgrade, the mobile phone is restarted to enter the recovery mode, themobile phone displays a screen (2), and the screen (2) displays aprogress indicator. For example, an upgrade progress is expressed byusing a progress bar 120. This process is essentially a process ofrefreshing the boot partition. After the upgrade is completed, themobile phone displays a screen (3), and the screen (3) displays a promptmessage prompting that the upgrade is completed and prompting the userto restart the mobile phone. When detecting a restart operation 130performed by the user, the mobile phone is restarted again to load therefreshed boot partition, and displays a startup screen shown in ascreen (4).

It can be seen that when the security policy file is updated in thecurrent OTA update manner, the mobile phone needs to be restarted twice.This manner may interrupt the current service. When a system upgradepatch package is relatively large, a repair time is relatively long andeven a risk that the mobile phone fails to be started if the upgradefails may occur.

To resolve the foregoing problem, an embodiment of this applicationprovides a method for updating a SELinux security policy. The method maybe applied to any terminal that has an operating system to which aSELinux technology is applied, such as a mobile phone, a wearabledevice, an augmented reality (AR)\virtual reality (VR) device, a tabletcomputer, a personal digital assistant (PDA), or an in-vehicle terminal.Certainly, in the following embodiment, a specific form of the terminalis not limited.

For example, the terminal is a mobile phone. As shown in FIG. 2, theterminal 200 includes: components such as a communications interface210, a memory 220, an input unit 230, one or more sensors 240, aprocessor 250, a power supply 260, a display unit 270, and an audiocircuit 280. It may be understood by a person skilled in the art that,the terminal structure shown in FIG. 2 does not constitute anylimitation on the terminal, and the terminal may include more or fewercomponents than those shown in the figure, or combine some components,or have different component arrangements.

The following describes the functional components of the terminal 200.

The communications interface 210 is configured for the terminal 200 tocommunicate with another device. The communications interface 210 may bespecifically implemented as a radio frequency (RF) circuit, and isconfigured to receive and send a signal in an information receiving andsending process or a call process. In particular, after receivingdownlink information of a base station, the communications interface 210sends the downlink information to the processor 250 for processing. Inaddition, the communications interface 210 sends uplink data to the basestation. Generally, the RF circuit includes but is not limited to anantenna, at least one amplifier, a transceiver, a coupler, a low noiseamplifier (LNA), a duplexer, or the like. In addition, the RF circuitmay further communicate with a network and another device throughwireless communication. The wireless communication may use anycommunications standard or protocol, including but not limited to globalsystem for mobile communications (GSM), a general packet radio service(GPRS), code division multiple access (CDMA), wideband code divisionmultiple access (WCDMA), long term evolution (LTE), an email, a shortmessage service (SMS), and the like.

The memory 220 may be configured to store a software program and module.The processor 250 executes various functional applications and dataprocessing of the terminal 200 by running the software program andmodule stored in the memory 220. The memory 220 may mainly include aprogram storage area and a data storage area. The program storage areamay store an operating system, and an application program (APP) requiredby at least one function such as a sound play function or an image playfunction. The data storage area may store data (such as audio data,image data, or an address book) created based on use of the terminal200, and the like. Certainly, the memory may further include a firstmemory and a second memory. The first memory is an “external memory” ofthe terminal, for example, the EMMC/UFS shown in FIG. 1A, and the secondmemory is an “internal memory” of the memory, for example, the DDR shownin FIG. 1A. In addition, the memory 220 may include a high-speed randomaccess memory, and may further include a non-volatile memory, such as atleast one magnetic disk storage device, a flash memory, or anothervolatile solid-state storage device.

The input unit 230 may be configured to receive digit or characterinformation input by a user, and generate a key signal input related toa user setting and function control of the terminal 200. Specifically,the input unit 230 may include a touchscreen 231 and another inputdevice 232. The touchscreen 231 is also referred to as a touch panel,and may collect a touch operation performed by a user on or near thetouchscreen 231 (for example, an operation performed by the user on ornear the touchscreen 231 by using any proper object or accessory such asa finger or a stylus), and drive a corresponding connection apparatus byusing a preset program. Optionally, the touchscreen 231 may include twoparts: a touch detection apparatus and a touch controller. The touchdetection apparatus detects a touch direction of the user, detects asignal brought by a touch operation, and transmits the signal to thetouch controller. The touch controller receives touch information fromthe touch detection apparatus, converts the touch information into touchcoordinates, and sends the touch coordinates to the processor 250. Inaddition, the touch controller can receive and execute a command sent bythe processor 250. In addition, the touchscreen 231 may be implementedby using a plurality of types such as resistive, capacitive, infrared,and surface acoustic wave. In addition to the touchscreen 231, the inputunit 230 may further include the another input device 232. Specifically,the another input device 232 may include but is not limited to one ormore of a physical keyboard, a function key (such as a volume controlkey or a power on/off key), a trackball, a mouse, a joystick, or thelike.

The sensors 240 include sensors configured to recognize biologicalfeatures, such as a fingerprint recognition sensor, a facial recognitionsensor, and an iris recognition sensor. The fingerprint recognitionsensor is used as an example. The fingerprint recognition sensor cancollect fingerprint information of a user and report the collectedfingerprint information to the processor 250, and the processor 250performs identity recognition on the user based on the fingerprintinformation.

The sensors 240 further include a gravity sensor, which may detect avalue of acceleration of the mobile phone in each direction (generallytri-axis), may detect a value and a direction of gravity when the mobilephone is motionless, and may be used in a posture recognitionapplication of the mobile phone (for example, switching betweenlandscape orientation and portrait orientation, a related game, ormagnetometer posture calibration), a function related to vibrationrecognition (for example, a pedometer or a stroke), or the like.

The terminal 200 may further include another sensor, for example, alight sensor. Specifically, the light sensors may include an ambientlight sensor and an optical proximity sensor. The ambient light sensormay adjust luminance of the display panel 231 based on brightness ofambient light. The optical proximity sensor may detect whether an objectapproaches or touches the mobile phone, and may turn off the displaypanel 231 and/or be backlight when the terminal 200 moves to an ear.Other sensors such as a gyroscope, a barometer, a hygrometer, athermometer, and an infrared sensor may also be configured for theterminal 200. Details are not described herein.

The display unit 270 may be configured to display information input bythe user or information provided for the user and various menus of theterminal 200. The display unit 270 may include a display panel 271.Optionally, the display panel 271 may be configured in a form of aliquid crystal display (LCD), an organic light-emitting diode (OLED), orthe like. Further, the touchscreen 231 may cover the display panel 271.After detecting a touch operation performed on or near the touchscreen231, the touchscreen 231 transmits the touch operation to the processor250 to determine a type of the touch event, and then the processor 250provides corresponding visual output on the display panel 271 based onthe type of the touch event. Although in FIG. 2, the touchscreen 231 andthe display panel 271 are used as two independent parts to implementinput and output functions of the terminal 200, in some embodiments, thetouchscreen 231 and the display panel 271 may be integrated to implementthe input and output functions of the terminal 200.

The audio circuit 280, the loudspeaker 281, and the microphone 282 mayprovide an audio interface between the user and the terminal 200. Theaudio circuit 280 may convert received audio data into an electricalsignal and transmit the electrical signal to the loudspeaker 281, andthe loudspeaker 281 converts the electrical signal into a sound signalfor output. In addition, the microphone 282 converts a collected soundsignal into an electrical signal, and the audio circuit 280 receives theelectrical signal, converts the electrical signal into audio data, andthen outputs the audio data to the RF circuit 210, to send the audiodata to, for example, another mobile phone, or outputs the audio data tothe memory 220 for further processing.

The processor 250 is a control center of the terminal 200. The processor250 is connected to all parts of the entire mobile phone by usingvarious interfaces and lines, and executes various functions and dataprocessing of the terminal 200 by running or executing the softwareprogram and/or module stored in the memory 220 and invoking data storedin the memory 220, thereby performing overall monitoring on the mobilephone. Optionally, the processor 250 may include one or more processingunits. Optionally, the processor 250 may integrate an applicationprocessor and a modem processor. The application processor mainlyprocesses the operating system, a user interface, an applicationprogram, or the like. The modem processor mainly processes wirelesscommunication. It may be understood that, alternatively, the modemprocessor may not be integrated into the processor 250.

The terminal 200 further includes the power supply 260 (such as abattery) supplying power to each component. Optionally, the power supplymay be logically connected to the processor 250 by using a powermanagement system, so that functions such as charge and dischargemanagement and power consumption management are implemented by using thepower management system.

Although not shown, the terminal 200 may further include an antenna, awireless-fidelity (Wi-Fi) module, a near field communication (NFC)module, a Bluetooth module, a loudspeaker, an accelerometer, agyroscope, and the like.

All the following methods provided in the embodiments of thisapplication may be applied to various terminals, including a mobilephone, shown in FIG. 2.

Referring to FIG. 3A, an embodiment of this application provides amethod for updating a SELinux security policy. The method includes thefollowing steps:

301. A terminal receives a security policy file sent by a server.

The security policy file is a common file. It can be seen that comparedwith the prior art in which the server pushes an image file includingthe security policy file to the terminal, the server needs to push onlythe security policy file to the terminal in this embodiment of thisapplication. Upgrade packets such as an OTA differential package do notneed to be generated on a server side.

302. The terminal stores the security policy file in preset storagespace while the terminal is in a power-on status.

The preset storage space is storage space in the terminal rather than amemory.

Optionally, a writable partition of the terminal may be, for example, adata partition in FIG. 1A.

This process may be considered as a process in which the terminaldownloads the security policy file.

303. The terminal performs validity and integrity check on the securitypolicy file stored in the preset storage space.

In an implementation, the server generates a digital signature toencrypt the security policy file, and pushes the encrypted securitypolicy file to the terminal. The terminal verifies the digital signatureof the security policy file to implement the security and/or integritycheck. For specific implementation of performing the security and/orintegrity check on the file, refer to the prior alt Details are notdescribed herein.

It should be noted that step 303 is an optional step, and the terminalmay directly perform the following step 304 after performing step 302:

304. The terminal reads the security policy file from the preset storagespace and writes the security policy file into a memory.

The memory is storage space for temporarily storing data in theterminal, in other words, storage space for caching data in theterminal, for example, the DDR 101 in FIG. 1A, and may also be asynchronous dynamic random access memory (SDRAM), or the like.

305. The terminal loads the security policy file in the memory.

It should be noted that when supporting the method for updating theSELinux security policy shown in step 301 to step 305 provided in thisembodiment of this application, the terminal may still be compatiblewith an existing method for updating a security policy file in an OTAupgrade manner. In actual application, the method provided in thisembodiment of this application is mainly applied to a scenario in whicha security policy file formulated by using a SELinux technology isupdated. A method updated in an OTA update manner may be used for alltypes of updates, and is a general update method.

The foregoing method provided in this embodiment of this application canupdate the security policy file formulated by using a SELinuxtechnology. In the update manner provided in this embodiment of thisapplication, the terminal does not need to be restarted, and a servicecurrently running on the terminal is not interrupted. In addition, afterreceiving the security policy file sent by the server, the terminal mayautomatically run the update method provided in this embodiment of thisapplication in the background. In addition, because only the securitypolicy file is updated and a process of refreshing a partition isomitted, an update speed of the security update process is large.Therefore, the updated security policy file can come into effectimmediately and quickly.

Referring to FIG. 4A, in an implementation, the foregoing step 302 tostep 305 may be completed through interaction of a specific service orprocess of the terminal. One process or service is used to download anupdated security policy file, and the other process or service is usedto load a downloaded security policy file. For example, anupdate_sepolicy service may interact with an init process forcompleting.

That the update_sepolicy service interacts with the init process tocomplete a specific implementation of the foregoing process includes thefollowing steps:

401. During the update_sepolicy service, the security policy file isstored in a preset directory of a preset writable partition of theterminal.

For example, the preset writable partition is a data partition, and thepreset directory may be a directory in the data partition suchas/data/security/sepolicy.bin.

Step 401 may be considered as a process of downloading the securitypolicy file during the update_sepolicy service.

402. During the update_sepolicy service, security and integrity check isperformed on the security policy file.

The update_sepolicy service is a newly created service in thisembodiment of this application, and is used to download a to-be-updatedsecurity policy file from a remote server, and perform the integritycheck.

Certainly, to support the update_sepolicy service in performing step402, the update_sepolicy service needs to have a read/write permissionon a directory of storing the security policy file. For example, if thesecurity policy file is stored in a /data/security/sepolicy.bindirectory, the update_sepolicy service needs to have a read/writepermission on a file under the directory.

Therefore, a premise on the update_sepolicy service in this embodimentof this application is set as follows: A write permission onthe/data/security/directory has been configured for the service beforedelivery.

For specific implementation of performing the security and integritycheck on the security policy file, refer to the prior art. Details arenot described herein.

After the check succeeds, the following step 403 is performed:

403. During the update_sepolicy service, a value of an attribute valueSELinux.reload_policy is set as 1.

Such attribute value as the SELinux.reload_policy is used to trigger aninit process to reload the security policy file. An initial value ofthis attribute value is 0. After the security policy file passes thesecurity check performed during the update_sepolicy service, theattribute value may be set to 1. When the attribute value being set to 1is monitored during the init process, during the init process, reloadingof the security policy file is tried. For details, refer to step 404.

Optionally, the update_sepolicy service may further set anotherself-defined attribute value. When a value of the attribute value is apreset value, the init process is also triggered to perform thefollowing step 404:

404. During the init process, the security policy file is read from thepreset directory of the preset writable partition, the security policyfile is written into a memory, and then the security policy file isloaded.

Optionally, when step 404 is performed, during the init process,security and integrity check may be performed on the security policyfile again, and the security policy file is loaded after the checksucceeds.

The init process is an existing process and a first user-mode process inthe system, and is used to load another subsequent system process. Forspecific implementation, refer to the prior alt Details are notdescribed herein.

Certainly, to support the init process in performing step 404,improvement of the init process in this embodiment of this applicationis as follows: A path of the loading policy file of the init process ismodified to a path specified in this embodiment of this application forstoring the security policy file, for example,/data/security/sepolicy.bin.

It can be seen that in the implementation shown in FIG. 4A, the securitypolicy file is downloaded during the update_sepolicy service andsecurity and integrity check of the security policy file are performedduring the update_sepolicy service. During the init process, thesecurity policy file is loaded and secondary check may be performed onthe file.

In consideration that after the terminal is restarted, the securitypolicy file in the image file (for example, the boot partition) in theread-only partition is loaded by default during the startup based on theexisting process, when the mobile phone is powered on again, after akernel starts an init.rc script, an attribute value of theSELinux.reload_policy needs to be set to 1 in a post-fs-dat phase. Inthis way, the init process is triggered to reread the security policyfile in the preset directory in the preset writable partition to loadthe security policy file, so as to cover the security policy file readfrom the boot partition.

Referring to FIG. 4B, in another implementation, the foregoing step 302to step 305 may be completed by a specific service or process of theterminal, for example, an update_sepolicy service.

That the update_sepolicy service completes the specific implementationof the process shown in step 302 to step 305 includes the followingsteps:

410. During the update_sepolicy service, the security policy file isstored in a preset directory of a preset writable partition of theterminal.

420. During the update_sepolicy service, security and integrity check isperformed on the security policy file.

For specific implementation of step 410 and step 42 o, refer to theforegoing step 401 and step 402. Details are not described herein.

After the check succeeds, the update_sepolicy service performs thefollowing step 430:

430. After the check succeeds, during the update_sepolicy service, thesecurity policy file is read from the preset directory of the presetwritable partition, the security policy file is written into a memory,and then the security policy file is loaded.

In the implementation shown in FIG. 4B, the security policy file isdownloaded during the update_sepolicy service, the security andintegrity check is performed during the update_sepolicy service, and thedownloaded security policy file is loaded during the update_sepolicyservice. Therefore, an attribute value of the SELinux.reload_policy doesnot need to be set.

In consideration that the image file in the read-only partition isloaded when the terminal is restarted, and the image file also includesthe security policy file, to perform the method shown in FIG. 4B, apolicy of loading the security policy file during startup is modified,to directly read and load the security policy file in the presetwritable partition specific to the update_sepolicy service.

In addition, in an implementation, the foregoing method provided in thisembodiment of this application automatically runs in a backgroundwithout being perceived by a user. In another implementation, referringto FIG. 5, as shown in the screen (1), in a process in which a userchats by using a “WeChat” application, after an updated security policyfile sent by a server is received, a prompt dialog box 502 is displayedon a WeChat screen 501 in a floating manner, and a message prompting auser that a security file in the mobile phone can be updated isdisplayed on the screen 502. When the mobile phone detects an operation503 performed by the user to determine an update, the method provided inthis embodiment of this application is performed by the mobile phonebackground to update the security policy file. The mobile phone displaysa screen (2), and displays, at an upper right corner of the screen (2),an update progress of the security file by using a progress bar 504 thatis zoomed out. After the update is completed, as shown in a screen (3),a prompt dialog box 505 is displayed on the WeChat screen 501, to promptthe user that the security policy file is updated. Certainly, the usermay also be prompted, in manners such as ringing, vibration, voice, orthe like, that the update is completed. When a determining operation 506performed by the user is detected, the mobile phone also displays onlythe WeChat screen 501.

It may be understood that, to implement the foregoing functions, theterminal in this application includes a corresponding hardware structureand/or software module for executing each function. A person skilled inthe art may be very easily aware that, in combination with the examplesdescribed in the embodiments disclosed in the embodiments of thisapplication, units and algorithm steps may be implemented by hardware ora combination of hardware and computer software in this application.Whether a function is performed by hardware or hardware driven bycomputer software depends on particular applications and designconstraints of the technical solutions. A person skilled in the art mayuse different methods to implement the described functions for eachparticular application, but it should not be considered that theimplementation goes beyond the scope of this application.

In the embodiments of this application, the terminal may be divided intofunction modules based on the foregoing method examples. For example,each function module may be obtained through division based on eachfunction, or two or more functions may be integrated into one processingmodule. The integrated module may be implemented in a form of hardware,or may be implemented in a form of a software function module. It shouldbe noted that, in the embodiments of this application, module divisionis an example, and is merely a logical function division. During actualimplementation, another division manner may be used.

Referring to FIG. 6, a terminal 600 disclosed in an embodiment of thisapplication includes: a receiving unit 601, a processing unit 602, and astorage unit 603, where the storage unit 603 specifically furtherincludes a first storage unit 6031 and a second storage unit 6032.

The receiving unit 601 is configured to receive a security policy filesent by a server. The processing unit 602 is configured to write thesecurity policy file 6031 into a first storage unit while the terminalis in a power-on status. The processing unit 602 is further configuredto read the security policy file from the first storage unit 6031 andwrite the security policy file into a second storage unit 6032. Theprocessing unit 602 is further configured to load the security policyfile in the second storage unit 6032.

Optionally, the processing unit 602 is further configured to performsecurity and/or integrity check on the security policy file stored inthe first storage unit 6031.

Optionally, the processing unit 602 is further configured to: store thesecurity policy file in the first storage unit 6031 by using a firstservice or process, modify a value of a preset attribute value from afirst value to a second value by using the first service or process, andwhen it is detected that the value of the preset attribute value ischanged from the first value to the second value, read the securitypolicy file from the first storage unit 6031 by using a second serviceor process and write the security policy file into the second storageunit 6032, and load the security policy file in the second storage unit6032 by using the second service or process.

Optionally, when the terminal is powered off, the value of the presetattribute value is changed from the second value to the first value, andwhen the terminal is restarted, the processing unit 602 is furtherconfigured to: in a kernel startup stage, modify the value of the presetattribute value from the first value to the second value, to read thesecurity policy file from the first storage unit 6031 and write thesecurity policy file into the second storage unit 6032 after it isdetected, in the second service or process, that the value of the presetattribute value is modified from the first value to the second value.

Optionally, the first service or process is an update_sepolicy service,the second service or process is an init process, and the presetattribute value is an attribute value of a SELinux.reload_policy.

Optionally, the processing unit 602 is further configured to: store thesecurity policy file in the first storage unit 6031 by using a presetservice or process, read the security policy file from the first storageunit 6031 and write the security policy file into the second storageunit 6032, and load the security policy file in the second storage unit6032.

Optionally, the preset service or process is an init process. The firststorage unit 6031 is a preset writable partition of the terminal.

The receiving unit 601 may be implemented by a communications interface210 of the terminal 200 shown in FIG. 2. The processing unit 602 may beimplemented by a processor 250 of the terminal 200 shown in FIG. 2. Thestorage unit 603 may be implemented by a memory 220 of the terminal 200shown in FIG. 2.

The foregoing terminal provided in this embodiment of this applicationcan update the security policy file formulated by using a SELinuxtechnology. In the update manner provided in this embodiment of thisapplication, the terminal does not need to be restarted, and a servicecurrently running on the terminal is not interrupted. In addition, afterreceiving the security policy file sent by the server, the terminal mayautomatically run the update method provided in this embodiment of thisapplication in the background. In addition, because only the securitypolicy file is updated and a process of refreshing a partition isomitted, an update speed of the security update process is large.Therefore, the updated security policy file can come into effectimmediately and quickly.

An embodiment of this application further provides a computer readablestorage medium. The computer readable storage medium stores aninstruction, and when the instruction is run on a terminal, the terminalis enabled to perform the methods described in the foregoing methodembodiments.

An embodiment of this application further provides a computer programproduct including an instruction. When the computer program product isrun on a terminal, the terminal is enabled to perform the methodsdescribed in the foregoing method embodiments.

Methods or algorithm steps described with reference to content disclosedin this application may be implemented by hardware, or may beimplemented by a processor executing a software instruction. Thesoftware instruction may include a corresponding software module. Thesoftware module may be stored in a random access memory (RAM), a flashmemory, a read-only memory (ROM), an erasable programmable read-onlymemory (Erasable Programmable ROM, EPROM), an electrically erasableprogrammable read-only memory (Electrically EPROM, EEPROM), a register,a hard disk, a mobile hard disk, a compact disc read-only memory(CD-ROM), or any other form of storage medium well-known in the art. Forexample, a storage medium is coupled to a processor, so that theprocessor can read information from the storage medium or writeinformation into the storage medium. Certainly, the storage medium maybe a component of the processor. The processor and the storage mediummay be located in the application specific integrated circuit (ASIC).

A person skilled in the art should be aware that in the foregoing one ormore examples, functions described in this application may beimplemented by hardware, software, firmware, or any combination thereof.When software is used for implementation, the foregoing functions may bestored in a computer readable medium or transmitted as one or moreinstructions or code in the computer readable medium. The computerreadable medium includes a computer storage medium and a communicationsmedium, where the communications medium includes any medium that enablesa computer program to be transmitted from one place to another. Thestorage medium may be any available medium accessible to ageneral-purpose or dedicated computer.

The objectives, technical solutions, and benefits of this applicationare further described in detail in the foregoing specific embodiments.It should be understood that the foregoing descriptions are merelyspecific embodiments of this application, but are not intended to limitthe protection scope of this application. Any modification, equivalentreplacement or improvement made based on technical solutions of thisapplication shall fall within the protection scope of this application.

1. A method, comprising: receiving, by a terminal, a security policyfile sent by a server for a security enhanced Linx (SELinux) securitypolicy; and performing, by the terminal in a power-on status, afterreceiving the security policy file: storing, by the terminal, thesecurity policy file in preset storage space using at least one of afirst service or process; reading, by the terminal, the security policyfile from the preset storage space and writing the security policy fileinto a memory, wherein the reading the security policy file from thepreset storage space and writing the security policy file into thememory comprises: modifying, by the terminal, a value of a presetattribute value from a first value to a second value by using the atleast one of the first service or process; reading, by the terminal, inresponse to the terminal detecting that the value of the presetattribute value is changed from the first value to the second value, thesecurity policy file from the preset storage space using at least one ofa second service or process; and writing the security policy file intothe memory; and loading, by the terminal, the security policy file inthe memory using the at least one of the second service or process. 2.The method according to claim 1, further comprising: performing, by theterminal, before the reading, by the terminal, the security policy filefrom the preset storage space and writing the security policy file intoa memory, at least one of a security or integrity check on the securitypolicy file stored in the preset storage space.
 3. (canceled)
 4. Themethod according to claim 1, wherein, when the terminal is powered off,the value of the preset attribute value is changed from the second valueto the first value; and wherein the modifying the value of the presetattribute value from the first value to the second value by using the atleast one of the first service or process comprises modifying, by theterminal, when the terminal is restarted, in a kernel startup stage, thevalue of the preset attribute value from the first value to the secondvalue.
 5. The method according to claim 4, wherein the at least one ofthe first service or process is an update_sepolicy service, wherein theat least one of the second service or process is an init process, andwherein the preset attribute value is an attribute value of aSELinux.reload_policy. 6-7. (canceled)
 8. The method according to claim4, wherein the preset storage space is a preset writable partition ofthe terminal. 9-16. (canceled)
 17. A terminal, comprising: acommunications interface; a bus; a processor; a first memory; a secondmemory; and a non-transitory computer readable memory storing programcode for execution by the processor, the program including instructionsto: receive, through the communications interface, a security policyfile sent by a server; write the security policy file into the firstmemory using at least one of a first service or process while theterminal is in a power-on status; modify a value of a preset attributevalue from a first value to a second value using the at least one of thefirst service or process; and perform, in response to detecting that thevalue of the preset attribute value is changed from the first value tothe second value: read the security policy file from the first memory byusing at least one of a second service or process; write the securitypolicy file into the second memory; and load the security policy file inthe second memory using the at least one of the second service orprocess.
 18. The terminal according to claim 17, wherein the programfurther includes instructions to to perform at least one of a securityor integrity check on the security policy file stored in the firstmemory.
 19. (canceled)
 20. The terminal according to claim 17, whereinwhen the terminal is powered off, the value of the preset attributevalue is changed from the second value to the first value; and whereinthe program further includes instructions to, when the terminal isrestarted, in a kernel startup stage, modify the value of the presetattribute value from the first value to the second value, to read thesecurity policy file from the first memory and write the security policyfile into the second memory after it is detected, in the at least one ofthe second service or process, that the value of the preset attributevalue is modified from the first value to the second value.
 21. Theterminal according to claim 20, wherein the at least one of the firstservice or process is an update_sepolicy service, wherein the at leastone of the second service or process is an init process, and wherein thepreset attribute value is an attribute value of a SELinux.reload_policy.22-23. (canceled)
 24. The terminal according to claim 20, wherein thefirst memory is a preset writable partition of the terminal. 25-26.(canceled)
 27. A method, comprising: receiving, by a terminal, asecurity policy file sent by a server for a security enhanced Linx(SELinux) security policy; and performing, by the terminal in a power-onstatus, after the receiving the security policy file: storing, by theterminal, the security policy file in preset storage space by using atleast one of a first preset service or process; reading, by theterminal, the security policy file from the preset storage space andwriting the security policy file into a memory using at least one of atleast one of a second preset service or process; and loading, by theterminal, the security policy file in the memory by using the at leastone of the second preset service or process.
 28. The method according toclaim 27, further comprising: performing, by the terminal, before thereading the security policy file and the writing the security policyfile, at least one of a security or integrity check on the securitypolicy file stored in the preset storage space.
 29. The method accordingto claim 27, wherein the at least one of the second preset service orprocess is an init process.
 30. The method according to claim 28,wherein the preset storage space is a preset writable partition of theterminal.